Cloud Run MCP bucket squatting: attacker intercepts proprietary source code, executes code, and exfiltrates data

Google Cloud Run MCP before 1.11.0 did not verify ownership of the GCS bucket it relies on for source deployment, allowing an attacker to squat the bucket and capture source code, execute arbitrary code, and exfiltrate data (CWE-340). NVD lists it HIGH (CVSS 7.7), published 2026-10-26; the v1.11.0 release adds an ownership check.

This is the agent deployment path for Cloud Run: an AI agent uses the MCP server to deploy source from a bucket and inspect services. Bucket squatting turns a chain that is supposed to be trusted into a supply-chain interception point for the proprietary code that agents deploy and the service data they manage.

The server stored or addressed build/source artifacts in a Google Cloud Storage bucket whose name could be claimed first (bucket squatting). An attacker registering that bucket intercepts the source archive the agent uploads, reads proprietary code, and can inject code or exfiltrate data from the deployment workflow.

Google Cloud Run MCP (GoogleCloudPlatform/cloud-run-mcp) versions before 1.11.0.

Upgrade to Cloud Run MCP 1.11.0 or later. The fix (release v1.11.0, PR #300 'fix: check bucket ownership') verifies bucket ownership before using it for source/deploy artifacts.